NSX Corfu Certificate Replacement on Cosmin.us

Replacing the idps reporting Corfu certificate in NSX

Cosmin Trif — Fri, 07 Jul 2023 21:27:15 +0000

In this blog we will go over replacing the idps reporting Corfu certificate in NSX Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.

Identifying the Expired Certificate

In my case the cluster manager Corfu certificate has already expired

Generating a New Self-Signed Certificate

In the top menu bar I went to Generate -> Generate Self Signed Certificate

Next I had to grab the new certificate ID

Applying the Certificate via the NSX API

The next step is to replace the old certificate with the new certificate via an API call. For this I used Postman but any other tool could potentially be used.

The URL for the post call would go against https://nsx-vip-01a.corp.local/api/v1/trust-management/certificates/cert_id?action=apply_certificate&service_type=CBM_IDPS_REPORTING&node_id=node_id

The node ID can be found under Appliances -> View details on node, the value to the right for UUID ex

For authentication I used basic, per best practices we should be using a token.

For headers had to add Content-Type application\json ex

In the body I picked raw and added the following in

{ "cert_id": "0cc2f4f0-f409-4849-bf01-cfe454349a12",
"service_type": "CBM_IDPS_REPORTING" }

The cert ID is from the certificate I generated earlier. ex

Once I clicked send I was presented back with a 200 OK

Verifying the New Certificate

Going in the web browser I can also see that the new certificate is now used and the old one doesn’t have anything assigned to it ex

Deleting the Old Certificate

The final step I did was removing the old certificate by clicking on the 3 dots to left and picking delete from the menu

The same process applies to the other Corfu services — for example, see replacing the AR Corfu certificate.

Replacing the cluster manager Corfu certificate in NSX

Cosmin Trif — Fri, 07 Jul 2023 21:11:24 +0000

In this blog we will go over replacing the cluster manager Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.

In my case the cluster manager Corfu certificate has already expired

Generating a Self Signed Certificate

In the top menu bar I went to Generate -> Generate Self Signed Certificate

Next I had to grab the new certificate ID

Replacing the Certificate via the API

The next step is to replace the old certificate with the new certificate via an API call. For this I used Postman but any other tool could potentially be used.

The URL for the post call would go against https://nsx-vip-01a.corp.local/api/v1/trust-management/certificates/cert_id?action=apply_certificate&service_type=CBM_CLUSTER_MANAGER&node_id=node_id

The node ID can be found under Appliances -> View details on node, the value to the right for UUID ex

For authentication I used basic, per best practices we should be using a token.

For headers had to add Content-Type application\json ex

In the body I picked raw and added the following in

{ "cert_id": "0d77eb4c-b305-41a1-b0c4-da7260191d6d",
"service_type": "CBM_CLUSTER_MANAGER" }

The cert ID is from the certificate I generated earlier. ex

Once I clicked send I was presented back with a 200 OK

Verifying the New Certificate

Going in the web browser I can also see that the new certificate is now used and the old one doesn’t have anything assigned to it ex

Removing the Old Certificate

The final step I did was removing the old certificate by clicking on the 3 dots to left and picking delete from the menu

I have similar walkthroughs for the MP Corfu certificate and the CCP Corfu certificate in NSX.

Replacing the Monitoring Corfu certificate in NSX

Cosmin Trif — Fri, 07 Jul 2023 20:57:03 +0000

In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.

In my case the Monitoring Corfu certificate has already expired

Generating a Self-Signed Certificate

In the top menu bar I went to Generate -> Generate Self Signed Certificate

Next I had to grab the new certificate ID

Replacing the Certificate via API

The next step is to replace the old certificate with the new certificate via an API call. For this I used Postman but any other tool could potentially be used.

The URL for the post call would go against https://nsx-vip-01a.corp.local/api/v1/trust-management/certificates/cert_id?action=apply_certificate&service_type=CBM_MONITORING&node_id=node_id

The node ID can be found under Appliances -> View details on node, the value to the right for UUID ex

For authentication I used basic, per best practices we should be using a token.

For headers had to add Content-Type application\json ex

In the body I picked raw and added the following in

{ "cert_id": "de5aed8d-cc84-4d0b-b487-8b6be2a022ba",
"service_type": "CBM_MONITORING" }

The cert ID is from the certificate I generated earlier. ex

Once I clicked send I was presented back with a 200 OK

Verifying the New Certificate

Going in the web browser I can also see that the new certificate is now used and the old one doesn’t have anything assigned to it ex

Removing the Old Certificate

The final step I did was removing the old certificate by clicking on the 3 dots to left and picking delete from the menu

The same procedure applies to the other Corfu services as well, for example the CCP Corfu certificate.

Replacing the CSM Corfu certificate in NSX

Cosmin Trif — Fri, 07 Jul 2023 20:16:48 +0000

In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate. I covered the same procedure for the MP Corfu certificate and the CCP Corfu certificate in separate posts.

The Expired CSM Corfu Certificate

In my case the CSM Corfu certificate has already expired

Generating a New Self-Signed Certificate

In the top menu bar I went to Generate -> Generate Self Signed Certificate

Next I had to grab the new certificate ID

Applying the Certificate via the NSX API

The next step is to replace the old certificate with the new certificate via an API call. For this I used Postman but any other tool could potentially be used.

The URL for the post call would go against https://nsx-vip-01a.corp.local/api/v1/trust-management/certificates/cert_id?action=apply_certificate&service_type=CBM_CSM&node_id=node_id

The node ID can be found under Appliances -> View details on node, the value to the right for UUID ex

For authentication I used basic, per best practices we should be using a token.

For headers had to add Content-Type application\json ex

In the body I picked raw and added the following in

{ "cert_id": "65f3c890-485c-4c54-b80a-51cef8db7124",
"service_type": "CBM_CSM" }

The cert ID is from the certificate I generated earlier. ex

Once I clicked send I was presented back with a 200 OK

Verifying the New Certificate

Going in the web browser I can also see that the new certificate is now used and the old one doesn’t have anything assigned to it ex

Deleting the Old Certificate

The final step I did was removing the old certificate by clicking on the 3 dots to left and picking delete from the menu. If the delete fails because the certificate is still in use by a node, see this fix.

Replacing the GM Corfu certificate in NSX

Cosmin Trif — Fri, 07 Jul 2023 20:10:51 +0000

In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate. The same overall flow applies to the other NSX Corfu services as well — I covered the MP Corfu and CCP Corfu certificate replacements in separate posts.

Identifying the Expired GM Corfu Certificate

In my case the GM Corfu certificate has already expired

Generating a Self Signed Certificate

In the top menu bar I went to Generate -> Generate Self Signed Certificate

Next I had to grab the new certificate ID

Applying the New Certificate via API

The next step is to replace the old certificate with the new certificate via an API call. For this I used Postman but any other tool could potentially be used.

The URL for the post call would go against https://nsx-vip-01a.corp.local/api/v1/trust-management/certificates/cert_id?action=apply_certificate&service_type=CBM_MP&node_id=node_id

The node ID can be found under Appliances -> View details on node, the value to the right for UUID ex

For authentication I used basic, per best practices we should be using a token.

For headers had to add Content-Type application\json ex

In the body I picked raw and added the following in

{ "cert_id": "570dace5-8c8a-4f0f-a08f-69dc2054285b",
"service_type": "CBM_GM" }

The cert ID is from the certificate I generated earlier. ex

Once I clicked send I was presented back with a 200 OK

Verifying the New Certificate

Going in the web browser I can also see that the new certificate is now used and the old one doesn’t have anything assigned to it ex

Deleting the Old Certificate

The final step I did was removing the old certificate by clicking on the 3 dots to left and picking delete from the menu

Replacing the MP Corfu certificate in NSX

Cosmin Trif — Fri, 07 Jul 2023 19:46:06 +0000

In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.

In my case the MP Corfu certificate has already expired

Generating a New Self-Signed Certificate

In the top menu bar I went to Generate -> Generate Self Signed Certificate

Next I had to grab the new certificate ID

Building the Trust-Management API Call

The next step is to replace the old certificate with the new certificate via an API call. For this I used Postman but any other tool could potentially be used.

The URL for the post call would go against https://nsx-vip-01a.corp.local/api/v1/trust-management/certificates/cert_id?action=apply_certificate&service_type=CBM_MP&node_id=node_id

The node ID can be found under Appliances -> View details on node, the value to the right for UUID ex

For authentication I used basic, per best practices we should be using a token.

For headers had to add Content-Type application\json ex

In the body I picked raw and added the following in

{ "cert_id": "e060f100-5e5a-42c8-b735-0cb58f944b43",
"service_type": "CBM_MP" }

The cert ID is from the certificate I generated earlier. ex

Verifying the Certificate Replacement

Once I clicked send I was presented back with a 200 OK

Going in the web browser I can also see that the new certificate is now used and the old one doesn’t have anything assigned to it ex

Removing the Old Certificate

The final step I did was removing the old certificate by clicking on the 3 dots to left and picking delete from the menu

If you also need to renew the Corfu API certificate, the process is very similar and I covered it in a separate guide.

Replacing the CCP Corfu certificate in NSX

Cosmin Trif — Fri, 07 Jul 2023 18:51:48 +0000

In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.

In my case the CCP Corfu certificate has already expired

Generating a Self-Signed Certificate

In the top menu bar I went to Generate -> Generate Self Signed Certificate

Next I had to grab the new certificate ID

Preparing the Trust-Management API Call

The next step is to replace the old certificate with the new certificate via an API call. For this I used Postman but any other tool could potentially be used.

The URL for the post call would go against https://nsx-vip-01a.corp.local/api/v1/trust-management/certificates/cert_id?action=apply_certificate&service_type=CBM_CCP&node_id=node_id

The node ID can be found under Appliances -> View details on node, the value to the right for UUID ex

For authentication I used basic, per best practices we should be using a token.

For headers had to add Content-Type application\json ex

Sending the Apply Certificate Request

In the body I picked raw and added the following in

{ "cert_id": "5a6f1a51-95ec-45f3-8b7a-92ac2abd75cb",

"service_type": "CBM_CCP" }

The cert ID is from the certificate I generated earlier. ex

Once I clicked send I was presented back with a 200 OK

Verifying the New Certificate

Going in the web browser I can also see that the new certificate is now used and the old one doesn’t have anything assigned to it ex

Deleting the Old Certificate

The final step I did was removing the old certificate by clicking on the 3 dots to left and picking delete from the menu

If the delete fails with a “Certificate cannot be deleted because it is used by 1 MP node” error, I covered the fix in this post.

Replacing the AR Corfu certificate in NSX

Cosmin Trif — Fri, 07 Jul 2023 17:18:16 +0000

In this blog we will go over replacing the Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.

Identifying the Expired AR Corfu Certificate

In my case the AR Corfu certificate has already expired

Generating a Self-Signed Certificate in the NSX UI

In the top menu bar I went to Generate -> Generate Self Signed Certificate

Next I had to grab the new certificate ID

Applying the Certificate via the Trust-Management API

The next step is to replace the old certificate with the new certificate via an API call. For this I used Postman but any other tool could potentially be used.

The URL for the post call would go against https://nsx-vip-01a.corp.local/api/v1/trust-management/certificates/cert_id?action=apply_certificate&service_type=CBM_AR&node_id=node_id

The node ID can be found under Appliances -> View details on node, the value to the right for UUID ex

For authentication I used basic, per best practices we should be using a token.

For headers had to add Content-Type application\json ex

In the body I picked raw and added the following in

{ "cert_id": "625fb6e6-00ff-4c59-9275-0e7583bcb0c7",

"service_type": "CBM_AR" }

The cert ID is from the certificate I generated earlier. ex

Once I clicked send I was presented back with a 200 OK

Verifying and Removing the Old Certificate

Going in the web browser I can also see that the new certificate is now used and the old one doesn’t have anything assigned to it ex

The final step I did was removing the old certificate by clicking on the 3 dots to left and picking delete from the menu

If other Corfu certificates have expired as well, I covered replacing the MP Corfu certificate and the cluster manager Corfu certificate in separate posts.

Replacing the Corfu API certificate in NSX

Cosmin Trif — Fri, 07 Jul 2023 16:29:11 +0000

In this blog we will go over replacing the Corfu API certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate.

Identifying the Expired Corfu Certificate

In my case the Corfu API certificate has already expired

Generating a New Self-Signed Certificate

In the top menu bar I went to Generate -> Generate Self Signed Certificate

Next I had to grab the new certificate ID

Applying the New Certificate via the NSX API

The next step is to replace the old certificate with the new certificate via an API call. For this I used Postman but any other tool could potentially be used.

The URL for the post call would go against https://nsx-vip-01a.corp.local/api/v1/trust-management/certificates/cert_id?action=apply_certificate&service_type=API&node_id=node_id

The node ID can be found under Appliances -> View details on node, the value to the right for UUID ex

For authentication I used basic, per best practices we should be using a token.

For headers had to add Content-Type application\json ex

In the body I picked raw and added the following in

{ "cert_id": "79a25913-643a-4aa0-9d1b-0262e2a706b0",

"service_type": "API" }

The cert ID is from the certificate I generated earlier. ex

Verifying the New Certificate

Once I clicked send I was presented back with a 200 OK

Going in the web browser I can also see that the new certificate is now used and the old one doesn’t have anything assigned to it ex

Removing the Old Certificate

The final step I did was removing the old certificate by clicking on the 3 dots to left and picking delete from the menu

NSX has several other Corfu certificates that expire the same way; for example, I covered replacing the MP Corfu certificate in a separate guide.